Splunk Search

Persistent queues splunktcp

SylviaB
New Member

Persistent queues are not available for splunktcp,
I use several Forwarders on networks n, sending to a central forwarder on network A, from here all data goes to a central indexer, I would like to use persistent queueing for dataloss prevention.

TCP/UPD/Syslog will work but not splunktcp.

Is there a way for getting this to work?

0 Karma

glentes
Path Finder

We are also searching for more information regarding the usage of persistent queues for splunktcp.
We want to avoid for example data loss during splunk update, where you need to stop the index cluster in case of major version update.
So you will loss "live data" like it comes for excample fron the windows_TA and or unix_ta (CPU, Ram, disk, etc.)

According to http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues:


Persistent queues are not available for these input types:

Monitor
Batch
File system change monitor
splunktcp (input from Splunk forwarders)

Is the above mentioned option recommended, documented and supported from splunk?

jdunlea_splunk
Splunk Employee
Splunk Employee

SylviaB - How are you trying to set this up? What sort of error message are you getting to say that it isn't working? I have it working currently using the following syntax

[splunktcp://9998]
persistentQueueSize=100GB

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...